Our weekly CVE report for Oct 19-25, 2026 tracks 4,222 new CVEs and 12 exploited vulnerabilities, including PHP2Shell flaws not yet in CISA KEV.
Related Posts:
This Weekly CVE Report Finds CISA KEV Trailing Daily Cybersecurity by Up to 8 Days
Six Exploited Flaws Missing From CISA KEV Lead This Weekly CVE Report
Weekly CVE Report Tracks 2,652 New Flaws and Seven Exploited Vulnerabilities (Sept. 28 - Oct. 4, 2026)
The post Weekly CVE Report Flags PHP2Shell and FortiSIEM Attacks Still Missing Fr
Attackers exploit Plex2Shell flaws to install crypto miners and proxy software. Admins should update their Plex Media Server.
Plex Media Server is designed to make movies, music, and other media available across devices. But when a server is exposed to the internet and runs vulnerable software, it can become an entry point for attackers who have little interest in your film collection.
On October 16, 2026, security researcher Zach Main published technical details and proof-of-concept (PoC
Attackers exploit Plex2Shell flaws to install crypto miners and proxy software. Admins should update their Plex Media Server.
Plex Media Server is designed to make movies, music, and other media available across devices. But when a server is exposed to the internet and runs vulnerable software, it can become an entry point for attackers who have little interest in your film collection.
On October 16, 2026, security researcher Zach Main published technical details and proof-of-concept (PoC) code for a vulnerability chain dubbed Plex2Shell. Within a day, researchers had observed attackers using the exploit against an internet-facing honeypot, deploying cryptocurrency-mining malware and proxy software. The incident is a reminder of how quickly a public exploit can be weaponized by threat actors.
The chain combines four vulnerabilities in Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Together, they can allow attackers to execute arbitrary code on vulnerable servers without valid credentials, provided the required conditions are met. The code runs with the privileges of the Plex service, giving attackers an opportunity to install additional software and abuse the host.
The technical details are available in Main’s original analysis, Plex2Shell. Plex had been notified of the vulnerabilities on July 27 and acknowledged the report on August 4, awarding a bug bounty. The company released fixes in September, before the exploit code became public.
The loader does not check the library’s name, executable permissions, digital signature, or symbols. As a result, the library’s ELF constructor can run with the same privileges as the Plex service.
“It doesn’t check for a lib prefix, doesn’t require the execute bit, doesn’t verify any signature, and doesn’t look for any specific symbol.” reads the report published by zmain.com. “When dlopen loads a shared object, it runs the ELF’s DT_INIT_ARRAY (constructor functions) before doing any symbol resolution. A .so that only has a constructor and no exported symbols will still execute its code on load. We then trigger a second transcode. The codec directory gets re-enumerated, the .so we wrote in Stage 4 gets loaded, and the constructor runs as uid=1000(plex).”
That detail matters because the final stage can exploit how Plex loads shared libraries. The chain uses a setting related to transcoding to influence execution, allowing a specially crafted library to run when Plex loads it. The result can be code execution under the service account, without requiring the attacker to obtain an interactive login first.
The first confirmed activity appeared on October 17, when a researcher monitoring a vulnerable Plex honeypot reported seeing exploitation in the wild.
“My honeypot mostly saw scanning and generic exploitation attempts. As of this morning (Oct 17th), I finally saw in the wild exploitation.” reports the researcher on BoredHackerBlog. “So by default, I don’t allow outbound traffic from my honeypots but due to how this vuln works, I had to go modify my settings later on so sadly I didn’t get payloads for all the attacks. It’s possible that I have partial data. I haven’t gone through pcaps and I had to modify settings for tcpdump anyway. The attacker could be using slightly modified code & technique too.”
The attackers used the publicly available exploit to deploy an XMRig-based cryptocurrency miner. Later that day, the researcher found a second payload named myawesomeproxy, which turns the compromised system into a proxy node and may allow others to use its internet connection.
Cryptomining consumes computing resources and electricity, while proxy software creates a different risk. Attackers can route traffic through compromised residential or business connections, potentially using their reputation and IP addresses to reach services or networks that might otherwise block suspicious infrastructure. A Plex server can therefore become more than a source of unwanted costs: it can provide an attacker with a foothold for further activity.
Plex released patched versions in September, and administrators should ensure they’re running Plex Media Server 1.43.3.10861 or later. This includes installations running on NAS devices, virtual machines, and Docker containers. Updating the application is the immediate priority, particularly for servers exposed directly to the internet.
Administrators should also investigate unexpected child processes launched by Plex, unexplained CPU usage, unfamiliar files in the Plex Codecs directory, and outbound connections to unrecognized IP addresses. The appearance of cryptocurrency miners or proxy processes deserves particular attention. Because attackers can change filenames, infrastructure, and payloads, detection shouldn’t depend on a fixed list of indicators alone.
The honeypot findings provide evidence of exploitation, but they don’t establish how many real-world systems have been compromised or identify the operators with certainty. Organizations should treat the activity as a warning to check exposure and patch promptly, rather than assume that every vulnerable server has already been attacked.
“I wouldn’t be surprised if threat actors deploy more sophisticated things. Plex may be hosted on residential IP and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails. (edit: see update at the bottom. i do see proxy being deployed now)” the researchers adds.
Plex Media Server vulnerabilities are exploited in the wild after the Plex2Shell PoC went public. Attackers drop miners. Update to 1.43.3.10861.
Related Posts:
Roundcube 1.6.20 and 1.7.5 Fix 20 Security Flaws, Including IMAP Command Injection
PwnEscape Linux Kernel Flaw CVE-2026-99999 Lets VM Guests Escape to the Host
CISA Warns of Critical Flaws in dcm4chee Medical Archive and Unpatched EseeCloud IP Cameras
The post Plex2Shell Exploited in the Wild: PoC Released for Unauthenticated Plex Medi
Entrar
